UNIX Password Replication Across Heterogeneous Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and replicating UNIX passwords across multiple computer systems is complicated due to varying password complexity requirements, expiration dates, and different encryption methods, which can lead to security vulnerabilities and user burden.
Innovation Solution
A password replication tool that synchronizes encrypted UNIX passwords from a source computer to target computers, ensuring compatibility with password complexity requirements and encryption methods, while prompting users to update passwords periodically to maintain security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are replicated across multiple UNIX systems, then user access convenience is improved, but security vulnerability increases due to varying password complexity requirements and encryption methods
Solution Approach 1:
The patent introduces a password replication tool as an intermediary system that mediates between source and target UNIX systems. This tool handles the complexity of different encryption methods and password complexity requirements by reading the encrypted password from the source system's shadow file, determining compatibility with target systems, and writing the password only if compatible. This intermediary approach resolves the contradiction by enabling convenient password synchronization while maintaining security through compatibility validation.
Solution Approach 2:
The patent applies parameter changes by dynamically adjusting the password replication process based on system-specific parameters such as encryption methods and password complexity requirements. The tool reads the encrypted password, determines the hashing function used, and modifies its behavior based on whether the target system supports the same encryption method and complexity requirements. This adaptive parameter adjustment allows secure replication across heterogeneous systems.
2Reliability
If password complexity requirements are enforced on all systems, then security is improved, but user burden increases due to frequent password changes and compatibility checks
Solution Approach 1:
The patent implements self-service by enabling the password replication tool to automatically handle password synchronization across multiple UNIX systems without requiring manual intervention. The tool autonomously reads encrypted passwords from shadow files, determines compatibility with target systems, and performs writes only when appropriate. This automation eliminates the need for users to manually manage password complexity requirements and compatibility checks on each system, significantly reducing user burden while maintaining security.
Solution Approach 2:
The patent applies preliminary action by performing compatibility checks and encryption method validation before actually replicating the password. The tool determines whether the target system supports the same hashing function and password complexity requirements as the source system, and only proceeds with replication if compatible. This preliminary validation prevents security issues before they arise while avoiding unnecessary password changes that would increase user burden.
3Reliability
If encrypted passwords are stored in /etc/shadow with restricted permissions, then security is improved, but password replication complexity increases due to access control requirements
Solution Approach 1:
The patent uses the password replication tool as an intermediary that bridges the security restriction in /etc/shadow with the need for password replication. The tool runs with appropriate privileges to read the encrypted password from the protected shadow file on the source system, processes the password data, and writes it to the shadow file on target systems. This intermediary approach maintains the security model of restricted shadow file access while enabling necessary replication functionality.
Solution Approach 2:
The patent applies universality by designing a multi-functional password replication tool that can operate across different UNIX system configurations. The tool universally handles various encryption methods, password complexity requirements, and system configurations through a single integrated solution. It reads encrypted passwords, determines hashing functions, validates compatibility across different systems, and performs secure writes, making it a universal tool that simplifies the complex task of password replication across heterogeneous UNIX environments.
Data Source
AI summary
A method of replicating a UNIX password from a source computer to a delimited set of target computers performed by an application executing on a computer system. The method comprises receiving an identity of a source computer, determining a date of a UNIX password associated with a user identity configured on the source computer, determining that the UNIX password associated with the user identity configured on the source computer is less than a predefined number of days old, receiving identities of a plurality of target computers, reading an encrypted UNIX password associated with the user identity from the source computer, and, for each of the target computers, writing the encrypted UNIX password into an entry associated to the user identity in a password file on the target computer.